Guess? Either you fell for a phish or my intuition tells me you may have run an infostealer malware (exfils data and leaves little trail). No matter what type of 2fa you have, it is useless if the auth token can be accessed post authentication (cookie theft basically).